CAS Authentication Symfony2

Question

Szukam pakietu do zintegrowania uwierzytelniania CAS w Symfony 2.3. Znalazłem te opcje i prawda jest taka, że ​​nie jestem przekonany, ponieważ prawie wszystkie pakiety wydają się być porzucone bez aktualizacji.

1.- Sensiolab/CasBundle: https://github.com/sensiolabs/CasBundle Dokumentacja jest skąpa i niekompletna. Nie znalazłem żadnych przykładów, jak z niego korzystać.

2.- BeSimple/BeSimpleSsoAuthBundle: https://github.com/BeSimple/BeSimpleSsoAuthBundle Z tym testuję i mam pewne problemy. Myślę, że jestem na czwartym problemie rozwiązanym, a ja dostaję się za innym.

3.- Symfony CAS Klient: https://wiki.jasig.org/display/CASC/Symfony+CAS+Client Całkowicie przestarzały

Naprawdę, istnieje więc kilka opcji do uwierzytelniania CAS w symfony?

Answer 1

Mam ten sam problem wcześniej i rozwiązałem go za pomocą BeSimpleSsoAuthBundle, ale musisz wprowadzić kilka zmian: Zakładając, że masz już swój podmiot użytkownika w swoim UserBundle, z unikalnym atrybutem musisz nadpisać : 1- BeSimple \ SsoAuthBundle \ zabezpieczeń \ Rdzeń \ użytkownik

<?php 

namespace Application\UserBundle\Security\BeSimple\SpawnedUserProvider; 

use BeSimple\SsoAuthBundle\Security\Core\User\SpawnedUserProvider; 
use Symfony\Component\Security\Core\User\UserInterface; 
use Symfony\Component\Security\Core\User\User; 
use Symfony\Component\HttpFoundation\RedirectResponse; 


class SsoUserProvider extends SpawnedUserProvider 
{ 
/** 
* @var array 
*/ 
private $roles; 

/** 
* Constructor. 
* 
* @param array $roles An array of roles 
*/ 
private $entityManager; 
private $securityContext; 

public function __construct($em, $securityContext) { 
    $this->em = $em; 
    $this->securityContext = $securityContext; 
} 

/** 
* {@inheritdoc} 
*/ 
public function loadUserByUsername($username) 
{ 
    $session = $this->securityContext; 

    $qb = $this->em->createQueryBuilder(); 
    $qb->select("u") 
     ->from('ApplicationUserBundle:User', 'u') 
     ->where('u.sgid = :sgid') 
     ->AndWhere('u.status = 1') 
     ->setParameter("sgid", $username); 

    $result = $qb->getQuery()->getOneOrNullResult(); 

    if ($result == NULL) { 
     $session->getFlashBag()->add('error', 'Vous ne pouvez pas vous connecter car votre compte est désactivé'); 
     return new RedirectResponse('login'); 
    } 

    $user_name = $result->getFirstName().' '.$result->getLastName(); 
    $session->set('userId', $result->getId()); 
    if ($result->getUserType() == 1) { 
     $this->roles = array('ROLE_ADMIN'); 
    }else if ($result->getUserType() == 0){ 
     $this->roles = array('ROLE_USER'); 
    }else{ 
     $session->getFlashBag()->add('error', 'Vous ne pouvez pas vous connecter car votre compte n\'a pas de rôle'); 
     return new RedirectResponse('logout'); 
    } 
    return $this->spawnUser($user_name); 
} 

/** 
* {@inheritDoc} 
*/ 
public function refreshUser(UserInterface $user) 
{ 
    if (!$user instanceof User) { 
     throw new UnsupportedUserException(sprintf('Instances of "%s" are not supported.', get_class($user))); 
    } 

    return $this->spawnUser($user->getUsername()); 
} 

/** 
* {@inheritDoc} 
*/ 
public function supportsClass($class) 
{ 
    return $class === 'Symfony\Component\Security\Core\User\User'; 
} 

/** 
* Spawns a new user with given username. 
* 
* @param string $username 
* 
* @return \Symfony\Component\Security\Core\User\User 
*/ 
private function spawnUser($username) 
{ 
    //$this->roles = $this->userType; 
    return new User($username, null, (array)$this->roles, true, true, true, true); 
    } 
} 

2- Zastąpienie również BeSimple \ SsoAuthBundle \ zabezpieczeń \ Rdzeń \ uwierzytelniania \ dostawca:

<?php 

namespace Application\UserBundle\Security\BeSimple\Authentication\Provider; 

use Symfony\Component\Security\Core\User\UserInterface; 
use Symfony\Component\Security\Core\Exception\UsernameNotFoundException; 
use Symfony\Component\Security\Core\Exception\BadCredentialsException; 
use BeSimple\SsoAuthBundle\Security\Core\User\UserFactoryInterface; 

/* 
* @Override 
*/ 
use BeSimple\SsoAuthBundle\Security\Core\Authentication\Provider\SsoAuthenticationPr ovider; 

class AppAuthenticationProvider extends SsoAuthenticationProvider 
{ 
/** 
* @var UserProviderInterface 
*/ 
private $userProvider; 

/** 
* @var bool 
*/ 
private $createUsers; 

/** 
* @var bool 
*/ 
private $hideUserNotFound; 

/** 
* @Override file 
* @throws \Symfony\Component\Security\Core\Exception\UsernameNotFoundException 
* @throws \Symfony\Component\Security\Core\Exception\BadCredentialsException 
* 
* @param string $username 
* @param array $attributes 
* 
* @return UserInterface 
*/ 
protected function provideUser($username, array $attributes = array()) 
{ 
    try { 
     $user = $this->retrieveUser($username); 
    } catch (UsernameNotFoundException $notFound) { 
     if ($this->createUsers && $this->userProvider instanceof UserFactoryInterface) { 
      $user = $this->createUser($username, $attributes); 
     } elseif ($this->hideUserNotFound) { 
      throw new BadCredentialsException('Bad credentials', 0, $notFound); 
     } else { 
      throw $notFound; 
     } 
    } 

    return $user; 
    } 

} 

3- Kiedy użytkownik zalogować się do aplikacji zapisać potrzebne informacje w sesji:

<?php 

namespace Application\UserBundle\Security\Authentication\Handler; 

use Symfony\Component\HttpFoundation\Request; 
use Symfony\Component\HttpFoundation\RedirectResponse; 
use Symfony\Component\Routing\Router; 
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface; 
use Symfony\Component\Security\Core\SecurityContext; 
use Symfony\Component\Security\Http\Authentication\AuthenticationSuccessHandlerInterface; 
use Doctrine\ORM\EntityManager; 

class LoginSuccessHandler implements AuthenticationSuccessHandlerInterface 
{ 
protected 
    $router, 
    $security, 
    $entityManager; 

public function __construct(Router $router, SecurityContext $security, EntityManager $entityManager) 
{ 
    $this->router = $router; 
    $this->security = $security; 
    $this->entityManager = $entityManager; 
} 

public function onAuthenticationSuccess(Request $request, TokenInterface $token) 
{ 
    $session = $request->getSession(); 

    $attributes = $this->security->getToken()->getAttributes(); 
    $sgid = $attributes['sso:validation']['sgid']; 

    $em = $this->entityManager; 
    $qb = $em->createQueryBuilder(); 
    $qb->select("u") 
     ->from('ApplicationUserBundle:User', 'u') 
     ->where('u.sgid = :sgid') 
     ->AndWhere('u.status = 1') 
     ->setParameter("sgid", $sgid); 

    $result = $qb->getQuery()->getOneOrNullResult(); 

    //en cas où utilisateur est désactivée 
    //Malgre que si il arrive a cette handler ça veut dire qu'il activé car le test se fait sur le bundle BeSimple 
    if ($result == NULL) { 
     return new RedirectResponse($this->router->generate('login')); 
    } 

    $session->set('userId', $result->getId()); 

    $response = new RedirectResponse('admin'); 

    return $response; 
    } 
} 

4- teraz zdefiniować listner zabezpieczeń Application/UserBundle/Ressources/config/security_listeners.yml:

parameters: 
    security.authentication.provider.sso.class: Application\UserBundle\Security\BeSimple\Authentication\Provider\AppAuthenticationProvider 

services: 
    security.authentication.provider.sso: 
     class: %security.authentication.provider.sso.class% 
     public: false 
     arguments: ['', '@security.user_checker', '', '', false] 

5- The konfigurację BeSimple powinny jest tak jak:

be_simple_sso_auth: 
admin_sso: 
    protocol: 
     id: cas 
     version: 2 
    server: 
     id: cas 
     login_url: https://adresse ip:8443/cas-server-webapp-4.0.0/login 
     logout_url: https://adresse ip:8443/cas-server-webapp-4.0.0/logout 
     validation_url: https://adresse ip:8443/cas-server-webapp-4.0.0/serviceValidate 
services: 

    spawned_user_provider: 
     class:  Application\UserBundle\Security\BeSimple\SpawnedUserProvider\SsoUserProvider 
    arguments: [@doctrine.orm.entity_manager, @session] 

6- parameters.yml

be_simple.sso_auth.client.option.curlopt_ssl_verifypeer.value: false 
    be_simple.sso_auth.client.option.curlopt_sslversion.value: 4 (Optionale) 

7- The security.yml

main: 
     pattern: ^/admin 
     context: marketshare_context 
     logout: 
      path: /admin/logout 
      target:/
     #provider: sso 
     trusted_sso: 
      manager: admin_sso 
      login_action: ApplicationUserBundle:TrustedSso:login 
      logout_action: false 
      login_path: /admin/login 
      check_path: /admin/check 
      always_use_default_target_path: true 
      default_target_path: /admin/potentiel 
      failure_path: /admin/logout 

Answer 2

Można również przetestować l3-team/CasBundle wydaje nowsza & aktywny i jaśniejszym niż BeSimpleSSoBundle dokumentacji.

Wydaje się również wspierać pojedyncze logowanie.